Cybersecurity company Huntress, which is also tracking the activity, said it has observed attackers using access to cloud-hosted ScreenConnect panels to push Run commands with an aim to install rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The activity was first detected on November 11, 2026, at around 5:47 p.m. UTC.

Huntress told The Hacker News that it has not seen evidence of a new vulnerability, but noted the exact method through which the attacker got panel access remains unclear. Current telemetry points to compromised credentials or hijacked operator sessions to gain initial access, it said.